63
4-2-8. 802.1X
802.1x port-based network access control provides a method to restrict users to access network
resources via authenticating user’s information. This restricts users from gaining access to the network
resources through a 802.1x-enabled port without authentication. If a user wishes to touch the network
through a port under 802.1x control, he (she) must firstly input his (her) account name for authentication
and waits for gaining authorization before sending or receiving any packets from a 802.1x-enabled port.
Before the devices or end stations can access the network resources through the ports under
802.1x control, the devices or end stations connected to a controlled port send the authentication request
to the authenticator, the authenticator passes the request to the authentication server to authenticate and
verify, and the server tells the authenticator if the request receives the grant of authorization for the ports.
According to IEEE802.1x, there are three components implemented. They are Authenticator,
Supplicant and Authentication server shown in Fig. 4-13.
Supplicant:
It is an entity being authenticated by an authenticator. It is used to communicate with the
Authenticator PAE (Port Access Entity) by exchanging the authentication message when the
Authenticator PAE requests it.
Authenticator:
An entity facilitates the authentication of the supplicant entity. It controls the state of the port,
authorized or unauthorized, according to the result of authentication message exchanged
between it and a supplicant PAE. The authenticator may request the supplicant to re-
authenticate itself at a configured time period. Once it starts re-authenticating the supplicant,
the controlled port keeps in the authorized state until re-authentication fails.
A port acting as an authenticator is thought to be two logical ports, a controlled port and an
uncontrolled port. A controlled port can only pass the packets when the authenticator PAE is
authorized, and otherwise, an uncontrolled port will unconditionally pass the packets with PAE
group MAC address, which has the value of 01-80-c2-00-00-03 and will not be forwarded by
MAC bridge, at any time.
Authentication server:
A device provides authentication service, through EAP, to an authenticator by using
authentication credentials supplied by the supplicant to determine if the supplicant is
authorized to access the network resource.
The overview of operation flow for the Fig. 4-13 is quite simple. When Supplicant PAE issues a
request to Authenticator PAE, Authenticator and Supplicant exchanges authentication
message. Then, Authenticator passes the request to a RADIUS server to verify. Finally, the
RADIUS server replies if the request is granted or denied.
While in the authentication process, the message packets, encapsulated by Extensible
Authentication Protocol over LAN (EAPOL), are exchanged between an authenticator PAE and
a supplicant PAE. The Authenticator exchanges the message to authentication server using
EAP encapsulation. Before successfully authenticating, the supplicant can only touch the
authenticator to perform authentication message exchange or access the network from the
uncontrolled port.
